0f545f5c81
- classes.FrontendPermissionCatalog: the seeded rows, then codes activated plugins declare through pact.HasFrontendPermissions (seeded row wins); both permission editors offer it - classes.MCPUserGuard (guard "user"): reads user.api_token, user.scope:* and user.permission:*, allows with the route's checks (session scopes, group grants, every code), dispatches with an in-memory token credential, resolves usr_ personal tokens; registered in *pact.MCPGuards and published as pact.MCPPersonalTokenResolver - GET /_user/api/v1/token/me (user.api_token, user.scope:read) and the MCP tool me (user_me) - pact.MCPSubjectChanged on token revoke, Users saves and User Groups saves and deletes
104 lines
3.8 KiB
Go
104 lines
3.8 KiB
Go
package user
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"git.golem15.com/golem15/sm-user-plugin/controllers"
|
|
"git.golem15.com/golem15/summercms/modules/pact"
|
|
"git.golem15.com/golem15/summercms/modules/surf"
|
|
)
|
|
|
|
func (p *Plugin) Routes(r pact.Router) error {
|
|
guard, err := p.turnstileGuard()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
public, err := p.publicPasswordRoutes()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
r.Group("/_user/api/v1", surf.Use("throttle:user-api"), func(g pact.Router) {
|
|
if public {
|
|
g.Post("/login", controllers.Login(p.app), guard...)
|
|
}
|
|
g.Post("/logout", controllers.Logout(p.app))
|
|
g.Get("/fetch", controllers.Fetch(p.app))
|
|
g.Post("/refresh", controllers.Refresh(p.app))
|
|
g.Post("/register", controllers.Register(p.app), guard...)
|
|
g.Get("/oauth-providers", controllers.OAuthProviders(p.app))
|
|
if public {
|
|
g.Post("/forgot-password", controllers.ForgotPassword(p.app))
|
|
g.Post("/reset-password", controllers.ResetPassword(p.app))
|
|
}
|
|
g.Post("/activate", controllers.Activate(p.app))
|
|
g.Post("/activate-by-code", controllers.ActivateByCode(p.app))
|
|
g.Post("/update", controllers.Update(p.app))
|
|
g.Post("/change-password", controllers.ChangePassword(p.app))
|
|
g.Post("/marketing-consent", controllers.MarketingConsent(p.app))
|
|
g.Post("/avatar", controllers.UploadAvatar(p.app))
|
|
g.Post("/avatar/remove", controllers.RemoveAvatar(p.app))
|
|
g.Post("/tokens", controllers.APITokenStore(p.app), "jwt.auth")
|
|
g.Get("/tokens", controllers.APITokenIndex(p.app), "jwt.auth")
|
|
g.Delete("/tokens/{id}", controllers.APITokenDestroy(p.app), "jwt.auth")
|
|
g.Where("id", "[0-9]+")
|
|
g.Get("/backend-link/{code}", controllers.BackendLinkShow(p.app))
|
|
g.Where("code", "[a-f0-9]{64}")
|
|
g.Post("/backend-link/confirm", controllers.BackendLinkConfirm(p.app), "jwt.auth")
|
|
g.Get("/token/me", controllers.TokenMe(p.app), "user.api_token", "user.scope:read")
|
|
})
|
|
return nil
|
|
}
|
|
|
|
// turnstileGuard returns the middleware that golem15.user.turnstile adds to
|
|
// POST /login and /register. The key is opt-in: empty (the default) adds
|
|
// nothing, "open" and "closed" select the framework's turnstile:{mode}
|
|
// middleware (summercms v0.3.0 and later), and any other value is refused so
|
|
// a typo cannot silently leave the forms unprotected.
|
|
func (p *Plugin) turnstileGuard() ([]string, error) {
|
|
if p.app == nil || p.app.Config == nil {
|
|
return nil, nil
|
|
}
|
|
switch mode := strings.TrimSpace(p.app.Config.String("golem15.user.turnstile")); mode {
|
|
case "":
|
|
return nil, nil
|
|
case "open", "closed":
|
|
return []string{"turnstile:" + mode}, nil
|
|
default:
|
|
return nil, fmt.Errorf("golem15.user: golem15.user.turnstile must be empty, open or closed, got %q", mode)
|
|
}
|
|
}
|
|
|
|
// publicPasswordRoutes reports golem15.user.password.public_routes, which
|
|
// decides whether POST /login, /forgot-password and /reset-password are
|
|
// registered. The default is true. False leaves them unregistered, so they
|
|
// answer the router's own 404 like any unknown path. The key is read when the
|
|
// routes are built, so a change needs a restart. It takes a bool or the
|
|
// string true or false (any case, surrounding spaces trimmed; empty or unset
|
|
// means true); any other value is refused so a typo cannot silently remove
|
|
// (or keep) the sign-in routes.
|
|
func (p *Plugin) publicPasswordRoutes() (bool, error) {
|
|
if p.app == nil || p.app.Config == nil {
|
|
return true, nil
|
|
}
|
|
const key = "golem15.user.password.public_routes"
|
|
raw, ok := p.app.Config.Lookup(key)
|
|
if !ok || raw == nil {
|
|
return true, nil
|
|
}
|
|
switch v := raw.(type) {
|
|
case bool:
|
|
return v, nil
|
|
case string:
|
|
switch s := strings.TrimSpace(v); {
|
|
case s == "", strings.EqualFold(s, "true"):
|
|
return true, nil
|
|
case strings.EqualFold(s, "false"):
|
|
return false, nil
|
|
}
|
|
return false, fmt.Errorf("golem15.user: %s must be true or false, got %q", key, v)
|
|
default:
|
|
return false, fmt.Errorf("golem15.user: %s must be true or false, got %v", key, v)
|
|
}
|
|
}
|